[arch-security] [ASA-201506-2] cups: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201506-2
=========================================

Severity: Critical
Date    : 2015-06-10
CVE-ID  : CVE-2015-1158 CVE-2015-1159
Package : cups
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package cups before version 2.0.3-1 is vulnerable to multiple issues
including arbitrary code execution, privilege escalation and cross-side
scripting.

Resolution
==========

Upgrade to 2.0.3-1.

# pacman -Syu "cups>=2.0.3-1"

The problems have been fixed upstream in version 2.0.3.

Workaround
==========

None.

Description
===========

- CVE-2015-1158 (arbitrary code execution, privilege escalation)

An issue with how localized strings are handled in cupsd allows a
reference counter to over-decrement when handling certain print job
request errors. As a result, an attacker can prematurely free an
arbitrary string of global scope, creating a dangling pointer to a
repurposed block of memory on the heap. The dangling pointer causes ACL
verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL
handling failure results in unrestricted access to privileged
operations, allowing an unauthenticated remote user to upload a
replacement CUPS configuration file and mount further attacks.

- CVE-2015-1159 (cross-side scripting)

A cross-site scripting bug in the CUPS templating engine allows this bug
to be exploited when a user browses the web. In certain cases, the CGI
template can echo user input to file rather than escaping the text
first. This may be used to set up a reflected XSS attack in the QUERY
parameter of the web interface help page. By default, many linux
distributions run with the web interface activated.

Impact
======

A remote attacker is able to use a cross-side scripting flaw in order to
send a malicious print request that is leading to arbitrary code
execution and privilege escalation.

References
==========

https://www.cups.org/str.php?L4609
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159
https://bugs.archlinux.org/task/45279

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150610/c1cae787/attachment.asc>